The well-known hacker group NullCrew has discovered a non-persistent Cross Site scripting(XSS) vulnerability in official website of MasterCard. The subdomain "Mobile Payments Readiness(mobilereadiness.mastercard.com) found to be vulnerable to XSS attack.

Usually , the Non-persistent or reflected XSS are considered as low risk. Even thought the risk level is estimated as low, the attackers can steal user accounts by social engineering attack.

For instance , A hacker can redirect victim to malicious or phishing sites by injecting redirection script in the url. I have tested the redirection script,Successfully it redirects me to another site.

The above script redirects to google. An attacker can send the crafted-link and lure users into believe they are visiting legitimate master card site. But, in fact, they are being redirected to malicious site.

NullCrew has also discovered XSS vulnerability on the Department of Homeland Security.

A Security researcher, Riyaz Ahemed Walikar, has posted evidence of a serious persistent Cross Site Scripting(XSS) vulnerability on Tumblr, the popular microblogging platform.

XSS flaws are highly common on websites these days, but most of them are non-persistent and implicitly less dangerous.

"XSS can cause a lot of serious problems. An attacker can steal cookies, redirect users to fake or malicious sites, control a user's browser using automated frameworks like BeEF and download and execute exploits on the victim's computer," Researcher said in the blog post.

"Stored XSS is even more dangerous since the script is stored on the server and is executed everytime user visits an infected page."

Researcher found vulnerability on the 'Register Application' page at http://www.tumblr.com/oauth/apps. The application was not sanitizing user input when a user would create a new application. An XSS attack vector like tester "><img src='x' onerror="alert(document.cookie)"/> would trigger an alert box, displaying the user's cookie, in the browser.

Tumblr were notified more than three weeks ago on the issue. Finally, they fixed the vulnerability Today(july 14).

A security Researcher , Gambit, has discovered Cross site scripting vulnerability in Microsoft official website.

He found the vulnerability last month and reported the vulnerabilities to the Microsoft.

"Well last month I was looking around on MSN.com and Microsoft.com I found two XSS vulnerabilities, one in each domain. I reported the vulnerabilities to the Microsoft security team and secured a spot on their acknowledgments page."Gambit said in his blog.

Microsoft listed his name in the 'Security Researcher Acknowledgments for Microsoft Online Services' page.

'asia.perf.glbdns.microsoft.com' page is vulnerable to XSS. Researcher managed to execute the XSS code in the page.

The third security issue is very intersting persistent XSS. He discovered that there was a way for an attacker to get access to several key pieces of information in the URLs that Gmail generates when it displays a message to a user.

When a message is displayed directly, rather than as part of a user's inbox, it contains both a static user ID and an identifier for the individual message. Those values shouldn't be available to an attacker, but Juenemann found that he could get them through referrer leaks.

"An attacker doesn't know the ik and the message id . Without both values it's not possible to generate the special URL. But it's easy to get both values through referer leaking.

When the user opens the email message, the GIF image will send the user ID and message ID to theattacker's server. The second URL also will leak that data if the user clicks on it. The script will then display a Javascript alert, and that's the attacker's code runningin the context of Gmail.

Akshay AKA 0z0n3 claimed that he have discovered a Persistent XSS vulnerability in blogspot.com. He managed to inject the xss vector in his own blogger dashboard. He is sure it is not template page(usually templates allow bloggers to inject scripts ).

He used one of the following xss vector:
';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

<IMG """><SCRIPT>alert("XSS")</SCRIPT>">

After injecting, he didn't get a pop-up but after some minutes he started getting pop-ups. He reported about the vulnerability to Google Security team. The vulnerability is not rewarded by Google.

"Thank you for your note. We took a look at the XSS issue you reported. Unfortunatley, the XSS issues is executing on the blogspot domain and not blogger.com. We come some of these scenarios here.

Unfortunately, XSS issues on blogspot(as opposed to blogger.com) do not quailfy for the VRP. If you manage to execute this javascript on someone else's blog or on the blogger.com domain, that would qualify for a reward." Google response mail.

GreyHat Hackers Sony and Flexxpoint come with interesting xss found, discovered cross site scripting vulnerability in Odnoklassniki. Odnoklassniki (Одноклассники in Russian, Classmates) is a social network service for classmates and old friends reunion popular in Russia and other former Soviet Republics. It was created by Albert Popkov on March 4, 2006.

He provided the vulnerable link and video to demonstrate the vulnerability:

Grey Hat hacker "Sony" has discovered Cross site scripting(XSS) vulnerability in Radikal.ru. Radikal.ru is one of Russia's largest image hosting service that allows you to quickly publish photos on the various chat rooms, message boards, blogs and online forums.

It seems that the vulnerability has been fixed by vendor, the admin managed to filter html codes by converting to html special characters. Anyway we are able to retrieve the mirror of the vulnerability from XSSed.com.

A Hacker group TeamHav0k reformed and made a new group called "TeamDigi7al". The Hacker group become active now and exposed vulnerabilities in some high profile sites.

Hackers exposed the XSS vulnerabilities in NASA(careerlaunch.jpl.nasa.gov) , Vatican.va and weather.com. Hackers found SQL injection vulnerability in LoC(webarchive.loc.gov) and LFI vulnerability in Humboldt State University (humboldt.edu).

Hackers also hacked and dumped the Bolivian Ambassadors inbox. They upload a 62MB sized RAR file(Emails.rar) in uppit.com.

The GreyHat hacker 'Zer0Pwn ‏' has discovered Cross site scripting as well as Sql injection vulnerability in the Yale University website. We are not providing the SQL injection vulnerable link for security issue.

The POC for xss vulnerability:
http://bioinfo.mbb.yale.edu/genome/worm/search.cgi?orf=B0244.9%3Cscript%3Ealert%28%22Zer0Pwn%22%29%3C/script%3E

Security Researcher's "Matías Lonigro & Fabián Cuchietti" has discovered Self-XSS vulnerability Google Translator page. The vulnerability has been found in the 'translating a Document' option.

Google Translate provides an easy way to translate whole documents, without the need for copying and pasting large blocks of text. Simply click the translate a document link and submit your file as a PDF, TXT, DOC, PPT, XLS or RTF.

The uploader allows HTML files also. Unfortunately, it does not filter the HTML tags. It results in executing the HTML code as well as javascript code. Uploading HTML file embedded with javascript executes the script.

Researcher also provide a POC video:

Even Though this is self-XSS vulnerability, we can not simply ignore it. Hope , google will fix this issue as soon as possible.

GreyHat hackers Sony and Flexxpoint has discovered Reflected and Persistent XSS Vulnerability found in Vbulletin forum software, one of the famous and most powerful forum software. Hacker claimed that he found xss vulnerability in VBulletin 3.8.x - 4.1.11 .

Hacker have discovered XSS vulnerability in lot of places including '/forum/blog.php' ,'forum/group.php' pages in Vbulletin official websites.

Also hackers found persistent XSS vulnerability in chinclub.ru. They tested this vulnerability in other forums also.They tested this vulnerability in Demo vBulletin Forum. Version 4.1.10.(https://www.vbulletin.com/admindemo.php). Hacker said It's Work in other version too.

Hacker also provide us a simple POC video:

Also Another Hacker ".eof" discovered and published a POC for the xss vulnerability in vbulletin board lastmonth.